AI and privacy for Australian small businesses: what the OAIC says
What the OAIC's guidance on AI products means for small businesses: Privacy Act coverage, customer data in chatbots, transparency and checking output.
Short answer: if your business is covered by the Privacy Act, privacy obligations apply to any personal information you put into an AI tool and to any AI output that contains personal information. The OAIC’s best-practice advice is not to put personal information, especially sensitive information, into publicly available AI chatbots. Even if you’re not covered, its guidance is a sensible rulebook.
I’m not a lawyer and this isn’t legal advice. It’s a plain summary of what the regulator has published, with links so you can read it yourself.
Does the Privacy Act even cover my business?
Maybe not. According to the OAIC, most small businesses are not covered by the Privacy Act. A small business here means annual turnover of $3 million or less, counting all income from all sources.
But some are covered regardless of turnover, including: - health service providers - businesses that trade in personal information - operators of residential tenancy databases - contractors providing services under a Commonwealth contract - businesses that have opted in
The OAIC has a Privacy Checklist for Small Business, or you can ask your industry association or lawyer (OAIC).
The OAIC’s five big takeaways on AI
The OAIC published guidance on privacy and commercially available AI products in October 2024 (updated January 2025). Its top five takeaways, in my plain English:
- Privacy applies to inputs and outputs. Do your homework on a product before you use it, including how a human will oversee it and who can access the data.
- Be upfront. Update your privacy policy, and make sure public-facing AI like chatbots is clearly labelled as AI.
- AI-generated info about people counts. If AI generates or infers personal information, including hallucinations, that’s a collection of personal information and has to comply with the rules.
- Use data for the reason you collected it. Putting customer data into AI for a different purpose generally needs consent or has to be something the customer would reasonably expect.
- Keep personal info out of public chatbots. As best practice, don’t enter personal information, especially sensitive information, into publicly available generative AI tools.
Questions to ask before you pick a tool
The OAIC suggests businesses can answer these before choosing an AI product (OAIC):
- How will you use it, and what’s the privacy impact?
- What was it trained and tested on?
- What are its limits, and what safeguards has the developer put in?
- Where does it run, and are there known security risks?
- Will the developer or third parties get access to the data you put in or get out? Can you turn that off?
That last one is the big one. The OAIC notes some commercial AI products have terms or settings that let the provider use customer inputs to train their AI (OAIC). Check the settings.
Accuracy is a privacy issue
The OAIC points out that AI systems are known to produce inaccurate or false results, and that this risk is especially high with generative AI (OAIC). If you’re covered, you have to take reasonable steps to keep personal information accurate. In practice that means a person checks AI output before it’s used about a customer.
It’s not “set and forget”
The OAIC says due diligence shouldn’t be a “set and forget” approach. Review performance, train staff and monitor throughout the product’s life (OAIC).
How I handle it
The rule I build every Bonati AI setup around is that the assistant drafts and a person approves. The same rule applies to every client setup. I also check data settings on every tool during the audit.
FAQ
Does the Privacy Act apply to small businesses using AI? Most businesses with turnover of $3 million or less aren’t covered, but some are regardless of turnover. If you’re covered, the rules apply to personal information going into and coming out of AI tools.
Can I put customer details into ChatGPT? The OAIC recommends as best practice not entering personal information, especially sensitive information, into publicly available generative AI tools.
Do I have to tell customers I use AI? The OAIC says businesses should update privacy policies about AI use, and that public-facing tools like chatbots should be clearly identified as AI.
Is AI-generated information about a person covered? Yes. The OAIC says inferred, incorrect or generated information about an identifiable person, including hallucinations, is personal information.
Next step
If you want to know which jobs in your business are worth handing to AI, book a free AI audit. It takes 1–2 hours, there’s no obligation, and you walk away with a written plan of 3–5 tasks, whether you work with me or not.
Sources
- https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products
- https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business
